AVTCore K. Gross Internet-Draft AVA Networks Updates: 3550 (if approved) R. van Brandenburg Intended status: Standards Track TNO Expires: August 23, 2013 February 19, 2013 RTP and Leap Seconds draft-ietf-avtcore-leap-second-02 Abstract This document discusses issues that arise when RTP sessions span Universal Coordinate Time (UTC) leap seconds. It updates RFC 3550 to describe how RTP senders and receivers should behave in the presence of leap seconds. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on August 23, 2013. Copyright Notice Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Gross & van Brandenburg Expires August 23, 2013 [Page 1] Internet-Draft RTP Leap Seconds February 2013 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Leap seconds . . . . . . . . . . . . . . . . . . . . . . . . . 3 3.1. UTC behavior during leap second . . . . . . . . . . . . . . 4 3.2. NTP behavior during leap second . . . . . . . . . . . . . . 4 3.3. POSIX behavior during leap second . . . . . . . . . . . . . 4 3.4. Summary of leap-second behaviors . . . . . . . . . . . . . 4 4. Recommendations . . . . . . . . . . . . . . . . . . . . . . . . 5 4.1. RTP Sender Reports . . . . . . . . . . . . . . . . . . . . 6 4.2. RTP Packet Playout . . . . . . . . . . . . . . . . . . . . 6 5. Security Considerations . . . . . . . . . . . . . . . . . . . . 6 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 7 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 7 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 7 8.1. Normative References . . . . . . . . . . . . . . . . . . . 7 8.2. Informative References . . . . . . . . . . . . . . . . . . 7 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 8 Gross & van Brandenburg Expires August 23, 2013 [Page 2] Internet-Draft RTP Leap Seconds February 2013 1. Introduction In some media networking applications, RTP streams are referenced to a wall-clock time (absolute date and time). This is accomplished through use of the NTP timestamp field in the RTCP sender report (SR) to create a mapping between RTP timestamps and the wall clock. When a wall-clock reference is used, the playout time for RTP packets is referenced to the wall clock. Smooth and continuous media playout requires a smooth and continuous time base. The time base used by the wall clock may include leap seconds which are not rendered smoothly. This document updates RFC 3550 [1] providing recommendations for smoothly rendering streamed media referenced to common wall clocks which do not have smooth or continuous behavior in the presence of leap seconds. 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [2] and indicate requirement levels for compliant implementations. 3. Leap seconds The world scientific time standard is International Atomic Time (TAI) which is based on vibrations of cesium atoms in an atomic clock. The world civil time is based on the rotation of the Earth. In 1972 the civil time standard, Coordinated Universal Time (UTC), was redefined in terms of TAI and the concept of leap seconds was introduced to allow UTC to remain synchronized with with the rotation of the Earth. Leap seconds are scheduled by the International Earth Rotation and Reference Systems Service. Leap seconds may be scheduled at the last day of any month but are preferentially scheduled for December and June and secondarily March and September.[3] Because Earth's rotation is unpredictable, leap seconds are typically not scheduled more than six months in advance. Leap seconds do not respect local time and always occur at the end of the UTC day. Leap seconds can be scheduled to either add or remove a second from the day. A leap second that adds an extra second is known as a positive leap second. A leap second that skips a second is known as a negative leap second. All leap seconds since their introduction in 1972 have been scheduled in June or December and all Gross & van Brandenburg Expires August 23, 2013 [Page 3] Internet-Draft RTP Leap Seconds February 2013 have been positive. NOTE- The ITU is studying a proposal which could eventually eliminate leap seconds from UTC. As of January 2012, this proposal is expected to be decided no earlier than 2015.[4] 3.1. UTC behavior during leap second UTC clocks insert a 61st second at the end of the day when a leap second is scheduled. The leap second is designated "23h 59m 60s". 3.2. NTP behavior during leap second Under NTP [5] a leap second is inserted at the beginning of the last second of the day. This results in the clock freezing or slowing for one second immediately prior to the last second of the affected day. This results in the last second of the day having a real-time duration of two seconds. Timestamp accuracy is compromised during this period because the clock's rate is not well defined. 3.3. POSIX behavior during leap second Most POSIX systems insert the leap second at the end of the last second of the day. This results in repetition of the last second. A timestamp within the last second of the day is therefore ambiguous in that it can refer to a moment in time in either of the last two seconds of a day containing a leap second. 3.4. Summary of leap-second behaviors Table 1 summarizes behavior across a leap second for the wall clocks discussed above. Table 1 illustrates the leap second that occurred June 30, 2012 when the offset between International Atomic time (TAI) and UTC changed from 34 to 35 seconds. The first column shows RTP timestamps for an 8 kHz audio stream. The second column shows the TAI reference. Following columns show behavior for the leap-second-bearing wall clocks described above. Time values are shown at half-second intervals. Gross & van Brandenburg Expires August 23, 2013 [Page 4] Internet-Draft RTP Leap Seconds February 2013 +-------+--------------+--------------+--------------+--------------+ | RTP | TAI | UTC | POSIX | NTP | +-------+--------------+--------------+--------------+--------------+ | 8000 | 00:00:32.500 | 23:59:58.500 | 23:59:58.500 | 23:59:58.500 | | 12000 | 00:00:33.000 | 23:59:59.000 | 23:59:59.000 | 23:59:59.000 | | 16000 | 00:00:33.500 | 23:59:59.500 | 23:59:59.500 | 23:59:59.500 | | 20000 | 00:00:34.000 | 23:59:60.000 | 23:59:59.000 | 00:00:00.000 | | 24000 | 00:00:34.500 | 23:59:60.500 | 23:59:59.500 | 00:00:00.000 | | 28000 | 00:00:35.000 | 00:00:00.000 | 00:00:00.000 | 00:00:00.000 | | 32000 | 00:00:35.500 | 00:00:00.500 | 00:00:00.500 | 00:00:00.500 | +-------+--------------+--------------+--------------+--------------+ Table 1 NOTE- Some NTP implementations do not entirely freeze the clock while the leap second is inserted. Successive calls to retrieve system time return infinitesimally larger (e.g. 1 microsecond or 1 nanosecond) time values. This behavior is designed to satisfy assumptions applications may make that time increases monotonically. This behavior occurs in the least-significant bits of the time value and so is not typically visible in the human-readable format shown in the table. 4. Recommendations Senders and receivers which are not referenced to a wall clock are not affected by issues associated with leap seconds and no special accommodation is required. RTP implementation using a wall-clock reference is simplified by using a clock with a timescale which does not include leap seconds. IEEE 1588,[6] GPS [7] and other TAI [8] references do not include leap seconds. NTP time, operating system clocks and other UTC references include leap seconds. All participants working to a leap-second-bearing reference SHOULD recognize leap seconds and have a working communications channel to receive notification of leap second scheduling. Without prior knowledge of leap second schedule, NTP servers and clients may become offset by exactly one second with respect to their UTC reference. This potential discrepancy begins when a leap second occurs and ends when all participants receive a time update from a server or peer. Depending on the system implementation, the offset can last anywhere from a few seconds to a few days. A long-lived discrepancy can be particularly disruptive to RTP operation. Because of the timestamp ambiguity, positive leap seconds can Gross & van Brandenburg Expires August 23, 2013 [Page 5] Internet-Draft RTP Leap Seconds February 2013 introduce and the inconsistent manner in which different systems accommodate leap seconds, generating or using NTP timestamps during the entire last second of a day on which a positive leap second has been scheduled SHOULD be avoided. Note that the period to be avoided has a real-time duration of two seconds. In the Table 1 example, the region to be avoided is indicated by RTP timestamps 12000 through 28000 Negative leap seconds do not introduce timestamp ambiguity or other complications. No special treatment with respect to RTP timestamps is required in the presence of a negative leap second. 4.1. RTP Sender Reports RTP Senders working to a leap-second-bearing reference SHOULD NOT generate sender reports containing an originating NTP timestamp in the vicinity of a positive leap second. To maintain a consistent RTCP schedule and avoid the risk of unintentional timeouts, such senders MAY send receiver reports in place of sender reports in the vicinity of the leap second. For the purpose of suspending sender reports in the vicinity of a leap second, senders MAY assume a positive leap second occurs at the end of the last day of every month. Receivers working to a leap-second-bearing reference SHOULD ignore timestamps in any sender reports generated in the vicinity of a positive leap second. For the purpose of ignoring sender reports in the vicinity of a leap second, receivers MAY assume a positive leap second occurs at the end of the last day of every month. 4.2. RTP Packet Playout Receivers working to a leap-second-bearing reference SHOULD take both positive and negative leap seconds in the reference into account in determining playout time based on RTP timestamps for data in RTP packets. 5. Security Considerations RTP streams using a wall-clock reference as discussed here present an additional attack vector compared to self-clocking streams. Manipulation of the wall clock at either sender or receiver can potentially disrupt streaming. Gross & van Brandenburg Expires August 23, 2013 [Page 6] Internet-Draft RTP Leap Seconds February 2013 For an RTP stream operating to an leap-seocnd-bearing reference to operate reliably across a leap second, sender and receive must both be aware of the leap second. It is possible to disrupt a stream by blocking or delaying leap second notification to one of the participants. Streaming can be similarly affected if one of the participants can be tricked into believing a leap second has been scheduled where there is not one. These vulnerabilities are present in RFC 3550 [1] and these new recommendations neither heighten or diminish them. Integrity of the leap second schedule is the responsibility of the operating system and time distribution mechanism both of which are outside the scope of RFC 3550 [1] and these recommendations. 6. IANA Considerations This document has no actions for IANA. 7. Acknowledgements The authors would like to thank Steve Allen for his valuable comments in helping to improve this document. 8. References 8.1. Normative References [1] Schulzrinne, H., Casner, S., Frederick, R., and V. Jacobson, "RTP: A Transport Protocol for Real-Time Applications", STD 64, RFC 3550, July 2003. [2] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 8.2. Informative References [3] ITU-R, "Recommendation ITU-R TF.460-4 - Standard-frequency and time-signal emissions", February 2002. [4] ITU-R Working Party 7A, "Question SG07.236", February 2012. [5] Mills, D., Martin, J., Burbank, J., and W. Kasch, "Network Time Protocol Version 4: Protocol and Algorithms Specification", RFC 5905, June 2010. [6] IEEE, "IEEE Standard for a Precision Clock Synchronization Gross & van Brandenburg Expires August 23, 2013 [Page 7] Internet-Draft RTP Leap Seconds February 2013 Protocol for Networked Measurement and Control Systems", July 2008. [7] Global Positioning Systems Directorate, "Navstar GPS Space Segment/Navigation User Segment Interfaces", September 2011. [8] BIPM, "Circular T", May 2012. Authors' Addresses Kevin Gross AVA Networks Boulder, CO US Email: kevin.gross@avanw.com Ray van Brandenburg TNO Brassersplein 2 Delft 2612CT the Netherlands Phone: +31-88-866-7000 Email: ray.vanbrandenburg@tno.nl Gross & van Brandenburg Expires August 23, 2013 [Page 8]